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DETAILED ACTION 

1 . The instant application having Application No. 1 0/702,408 has a total of 29 
claims pending in the application, there are 3 independent claims and 26 dependent 
claims, all of which are ready for examination by the examiner. 

1. INFORMATION CONCERNING OATH/DECLARATION 

Oath/Declaration 

2. The applicant's oath/declaration has been reviewed by the examiner and is found 
to conform to the requirements prescribed in 37 C.F.R. ' 1.63. 

III. INFORMATION CONCERNING DRAWINGS 

Drawings 

3. The applicant's drawings submitted 06 November 2003 are acceptable for 
examination purposes. 

VI. REJECTIONS NOT BASED ON PRIOR ART 
Claim Rejections - 35 USC ' 112 

4. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

5. Claims 2, 21, and 23 are rejected under 35 U.S.C. 112, first paragraph, as failing 
to comply with the written description requirement. The claim(s) contains subject matter 
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which was not described in the specification in such a way as to reasonably convey to 
one skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. 

6. Regarding Claims 2, 21 , and 23, in Line 3 of Claim 2, Line 2 of Claim 21 , and 
Line 4 of Claim 23 a reference is made to "graphing byte density over time". Byte 
density is not adequately described in the disclosure. For the purposes of further 
examination the Examiner will interpret "graphing byte density over time" as "graphing 
network traffic over time". 

VII. REJECTIONS BASED ON PRIOR ART 

Claim Rejections - 35 USC ' 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claims 1-6, 9-11, and 13-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cook et al. (herein Cook (US Patent No. 6,965,574)) and further in 
view of Leftwich (US Patent No. 6,356,256). 

9. Regarding Claim 1, Cook discloses A method of analyzing network traffic on a 
network, the network traffic having been captured at a network monitoring computer 
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during a period of time, the method comprising: at a user computer remote from the 
network monitoring computer, receiving data points corresponding to the captured 
network traffic, the data points comprising: for the captured network traffic, start time, 
end time, total frames and total bytes; and information about sections of the captured 
network traffic, the information including start time, end time, number of frames in the 
section and number of bytes in the section. (See Cook: Figure 3) 

Cook fails to disclose storing a histogram, including the data points, at the user 
computer. 

Leftwich discloses storing a histogram, including the data points, at the user 
computer. (See Leftwich: Figure 4 and 3B) 

Cook: Figure 3 shows the organization of network traffic. The number of 
packets, number of bytes, flow start and end time are all present in the network 
traffic information. Knowing the flow start time and end time gives you the total 
clock ticks of the capture. In Leftwich: Figure 4 the graph contains tabs for usage 
statistics and burst management. These would be relating specifically to network 
traffic. In Leftwich: Figure 3B it is shown in the picture that the graphical user 
interface is connected across a network to the data gathering mass storage 
device, therefore making it remote. 

Cook and Leftwich are analogous art because they are from the same field of 
endeavor, presenting communication performance history data. 

At the time of invention it would have been obvious to one of ordinary skill in the 
art to use the graphical display of Leftwich to display the network traffic data of Cook. 
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The motivation for doing so would have been to make information easily 
perceivable by a user. (Leftwich: Column 1, Lines 28-31) 

Therefore, it would have been obvious to combine the graphical display of 
Leftwich with the network traffic data collecting system of Cook for the benefit of making 
information easily perceivable by a user to obtain the invention as specified in claim 1 . 

10. Claim 2 is rejected using the same rationale as Claim 1. 

1 1 . Regarding Claim 3, Leftwich discloses presenting a user with a graphical user 
interface representation of the network traffic comprises: including a zoom window, the 
zoom window useful for highlighting a segment of the capture histogram, and 
representing the segment of the capture histogram in a zoom histogram. (See 
Leftwich: Figure 5A and 5B also See Leftwich: Column 5, Lines 44-51) The user 
clicks and drags to create a zoom window and the zoom is then displayed as a 
response to the user input. 

12. Regarding Claim 4, Leftwich discloses including a data selection window useful 
for highlighting a segment of the zoom histogram; storing a first downloaded captured 
data file that includes sections corresponding to the segment of the zoom histogram 
highlighted by the data selection window; and displaying data frames corresponding to 
the highlighted segment of the zoom window. (See Leftwich: Column 5, Lines 37-42) 
The cursor is used to select a segment. Then the data points corresponding to 
the selection are shown in the histogram window, Figure 4, Element 36. 

13. Claim 5 is rejected using the same rationale as Claim 4. 

14. Claim 6 is rejected using the same rationale as Claim 1 . 
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1 5. Regarding Claim 9, Cook discloses the histogram further comprising a listing 
and description of downloaded captured data files stored on the user computer, the 
method further comprising using the listing and description of downloaded captured 
data files to code portions of the capture histogram and the zoom histogram with a first 
indicator representing sections stored at the user computer. The system locates the 
files when it needs to access them for processing and displaying. Therefore, the 
system must contain indicators to locate the files it is using. 

16. Claim 10 is rejected using the same rationale as Claim 9. 

17. Claim 11 is rejected using the same rationale as Claim 9. 

18. Regarding Claim 13, Cook discloses downloading sections from the network 
monitoring computer that are not stored in downloaded captured data files at the user 
computer; and combining the downloaded sections with a downloaded captured data 
file that was previously stored at the user computer. The original files were taken 
from the network monitoring computer and used at the graphical user interface of 
the user computer to generate the histogram. If specific files or data is requested 
that is not at the user computer the network monitoring computer is still fully 
capable of providing data. 

1 9. Regarding Claim 14, Cook discloses saving the histogram for later use. See 
Cook: Column 6, Lines 43-44. Cook discloses storing the data in persistent 
storage. 

20. Regarding Claim 15, Cook discloses opening the histogram; determining if the 
histogram corresponds to network traffic stored on the network monitoring computer 
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using timestamps; if the histogram corresponds to network traffic stored on the network 
monitoring computer, establishing a relationship between the network monitoring 
computer and the user computer such that network traffic existing on the network 
monitoring computer may be downloaded to the user computer. See Cook: Column 6, 
Lines 43-44. Cook discloses storing the data in persistent storage. If the system 
can store the data it also will be able to open the stored files. The original files 
were taken from the network monitoring computer and used at the graphical user 
interface of the user computer to generate the histogram. If the saved file opens 
and specific files or data that is requested is not at the user computer the network 
monitoring computer is still fully capable of providing data. 



21. 


Claim 16 


is rejected 


using the same rationale as Claim 


14. 


22. 


Claim 17 


is rejected 


using the same rationale as Claim 


1. 


23. 


Claim 18 


is rejected 


using the same rationale as Claim 


1. 


24. 


Claim 19 


is rejected 


using the same rationale as Claim 


1. 


25. 


Claim 20 


is rejected 


using the same rationale as Claim 


1. 


26. 


Claim 21 


is rejected 


using the same rationale as Claim 


1. 


27. 


Claim 22 


is rejected 


using the same rationale as Claim 


13. 


28. 


Claim 23 


is rejected 


using the same rationale as Claim 


1. 


29. 


The Examiner takes 


Official Notice that a top-level folder for organizing 



data fields into a file structure, along with the naming of the files, folders, etc. that 
are associated with the file structure, would be obvious to a person of ordinary 
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skill in the art. Many operating systems that have been used and that are used 
today include this function. 

30. Regarding Claim 24 is rejected using the same rationale as Claim 23. 

31 . Regarding Claim 25 is rejected using the same rationale as Claim 23. 

32. Regarding Claim 26 is rejected using the same rationale as Claim 23. 

33. Regarding Claim 27 is rejected using the same rationale as Claim 23. 

34. Regarding Claim 28 is rejected using the same rationale as Claim 15. 

35. Regarding Claim 29 is rejected using the same rationale as Claim 1. 

36. Claims 7 and 8 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Cook et al. (herein Cook (US Patent No. 6,965,574)), Leftwich (US Patent No. 
6,356,256), and further in view of Mazumder (US Patent No. 6,580,959). 

37. Regarding Claim 7, Cook and Leftwich disclose presenting a user with a 
graphical user interface representation of the network traffic. 

Cook and Leftwich fail to disclose applying a compression algorithm to at least a 
portion of the information in the histogram. 

Mazumder discloses applying a compression algorithm to at least a portion of the 
information in the histogram. 

Mazumder teaches using an efficient compression algorithm to enable fast 
transmission of a file. (Mazumder: Column 2, Lines 24-27) 

Cook, Leftwich, and Mazumder are analogous art because they are from the 
same field of endeavor, data monitoring and processing. 
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At the time of the invention it would have been obvious to a person of ordinary 
skill in the art to compress the histogram information of Cook and Leftwich with the 
compression algorithm of Mazumder. 

The motivation for doing so would have been to enable efficient and fast 
transmission over a network. (Mazumder: Column 2, Lines 24-27) 

Therefore it would have been obvious to combine the compression algorithm of 
Mazumder with the data monitoring and display system of Cook and Leftwich for the 
benefit of fast and efficient transmission over a network to obtain the invention as 
specified in claim 5. 

38. Claim 8 is rejected using the same rationale as Claim 7. 

39. Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over Cook et 
al. (herein Cook (US Patent No. 6,965,574)), Leftwich (US Patent No. 6,356,256), and 
further in view of Jamieson et al. (herein Jamieson (US Patent No. 6,577,323)). 

40. Regarding Claim 12, Cook and Leftwich fail to disclose using the listing and 
description of downloaded captured data files to color code portions of the capture 
histogram and the zoom histogram with a first color representing sections stored at the 
user computer, color coding portions of the capture histogram and the zoom histogram 
with a second color representing sections that were previously at the user computer, but 
that are not presently at the user computer; and color coding portions of the capture 
histogram and the zoom histogram with a third color representing sections that are not 
stored at the user computer or at the network monitoring computer. 
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Jamieson discloses using the listing and description of downloaded captured 
data files to color code portions of the capture histogram and the zoom histogram with a 
first color representing sections stored at the user computer, color coding portions of the 
capture histogram and the zoom histogram with a second color representing sections 
that were previously at the user computer, but that are not presently at the user 
computer; and color coding portions of the capture histogram and the zoom histogram 
with a third color representing sections that are not stored at the user computer or at the 
network monitoring computer. 

See Jamieson: Column 6, Line 60 - Column 7, Line 3. Jamieson teaches the 
use of color coding a graph according to varying indicators. The indicators may 
representative of many things. An indicator of data location is already part of the 
data file (see rejection rationale of Claim 7). The data plot can then be color coded 
according to data location. 

Cook, Leftwich, and Jamieson are analogous because they are from the same 
field of endeavor, data presentation. 

At the time of the invention it would have been obvious to one of ordinary skill in 
the art to combine the color coded background of Jamieson (Jamieson: Column 6, 
Line 64 - Column 7, Line 3) with the data plots of Cook and Leftwich. 

The motivation for doing so would have been to easily provide additional 
information to the user and to possibly to provide navigation to more detailed 
information. (Jamieson: Column 6, Line 64 - Column 7, Line 3) 
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41 . Therefore it would have been obvious to combine the color coded background of 
Jamieson with the data plots of Cook and Leftwich for the benefit of providing additional 
information to the user and possibly providing navigation to more detailed information to 
obtain the invention as specified in Claim 12. 



RESPONSE TO ARGUMENTS 

42. The Examiner acknowledges the Applicant's arguments regarding the USC 112, 
1 st paragraph enablement rejection. Upon consideration the Examiner has decided to 
change the rejection to a USC 112, 1 st paragraph lack of sufficient written description 
rejection. In light of this, the action has been made non-final. 

43. The Examiner would also like to acknowledge that the Applicant has cited 
various parts of the application in order to provide further context for the aforementioned 
terms. Although these terms are mentioned in the sections that Applicant has cited, the 
sections cited do not provide proper explanation or description of the terms in question. 
For example, the Figure cited in order to provide description to "graphing byte density 
over time" is simply a picture of a histogram. The axes are not labeled, no units are 
given, and nothing about the graph is shown other than stating that the graph shows 
graphing "byte density over time". Therefore the graph fails to further explain "graphing 
byte density over time". If the Applicant believes that these terms are readily apparent to 
one of ordinary skill in the art, the Examiner encourages the Applicant to provide a 
reference for support. 
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44. Applicant's arguments filed 10 July 2006 have been fully considered but they are 
not persuasive. 

45. Regarding Claim 1, Applicant contends that the Examiner has completely failed 
to identify which elements of Cook correspond with the elements and processes of 
claim 1. However, it would be known to one of ordinary skill in the art what 
elements of the Figure 3 of Cook fulfill the claimed limitations. Furthermore the 
Applicant contends that the Examiner is relying on personal knowledge as a basis for 
rejecting claim 1. However, the Examiner respectfully asserts that one of ordinary 
skill in the art would know that knowing the flow start time and end time gives 
you the total clock ticks of the capture. Also one of ordinary skill in the art would 
know in Leftwich: Figure 4 the graph contains tabs for usage statistics and burst 
management. These would be relating specifically to network traffic. 

46. Regarding Claim 9, Applicant contends that the Examiner is relying on personal 
knowledge as a basis for rejecting claim 9. However, it would be known to one of 
ordinary skill in the art that the system locates the files when it needs to access 
them for processing and displaying. Therefore, the system must contain 
indicators to locate the files it is using. 

47. Regarding Claim 13, Applicant contends that the Examiner is relying on 
personal knowledge as a basis for rejecting claim 13. However, it would be known to 
one of ordinary skill in the art that the original files were taken from the network 
monitoring computer and used at the graphical user interface of the user 
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computer to generate the histogram. If specific files or data is requested that is 
not at the user computer the network monitoring computer is still fully capable of 
providing data. 

48. Regarding Claim 15, Applicant contends that the Examiner is relying on 
personal knowledge as a basis for rejecting claim 15. However, it would be known to 
one of ordinary skill in the art that if the system can store the data it also will be 
able to open the stored files. The original files were taken from the network 
monitoring computer and used at the graphical user interface of the user 
computer to generate the histogram. If the saved file opens and specific files or 
data that is requested is not at the user computer the network monitoring 
computer is still fully capable of providing data. 

49. Regarding the motivation to combine Cook with Leftwich, Applicant 
contends that there is not motivation to combine the teachings of Leftwich and Cook. 
However, the Examiner respectfully asserts that Leftwich does indeed "make 
information easily perceivable by a user" as quoted in Column 1, Lines 28-31 of 
Leftwich. More specifically the Applicant contends that 'easily' is not defined, 
however Leftwich states that information is made easily perceivable to the user 
and therefore it is inherent in the reference. Furthermore, Applicant contends that 
there is an absence of evidence that Cook is deficient in terms of making information 
perceivable to the user. Cook makes no mention of making the information 
perceivable to the user and does not disclose a histogram. This is the reason that 
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Leftwich was combined with Cook, to provide the teaching of a histogram that 
makes information easily perceivable by a user. 

50. Regarding Claims 19 and 23, Applicant contends that these claims are not the 
same as each other nor are they the same as claim 1 . However the Examiner notes 
that Claim 19 and 23 are rejected using the same rationale. It would be known to 
one of ordinary skill in the art what elements of the Figure 3 of Cook fulfill the 
claimed limitations. Furthermore, regarding claim 23 the limitations not disclosed 
using the rationale used to reject claim 1 are rejected using Official Notice. 

51 . Regarding claim 23, Applicant contends that the Examiner has used personal 
knowledge in taking Official Notice. However, using Almond et al ((US Patent No. 
6,112,024) herein after Almond) as an evidentiary reference, it is noted that in 
Figures 7A -7C Column 46, Lines 15-26 Almond teaches the top-level folder file 
structure. Also in Column 47, Lines 15-50 Almond discloses creating and 
naming folders and objects, or files. 

52. Regarding the motivation to combine Cook and Leftwich with Mazumder, 

Applicant contends that there is not motivation to combine the teachings of Cook and 
Leftwich with Mazumder. Applicant implies that the motivation is poorly defined and an 
opinion of the Examiner. However, the motivation is cited directly from the 
reference and therefore is inherently taught by the reference. Furthermore, 
Applicant contends that there is an absence of evidence that Cook/Leftwich is deficient 
in terms of network transmission. Cook/Leftwich do not mention that they are 
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proficient in network transmission, which is why the reference of Mazumder is 
brought in to provide efficient and fast transmission. 

53. Regarding claim 12, Applicant contends that the Examiner uses personal 
knowledge to reject claim 12. However, it would be known to one of ordinary skill in 
the art that an indicator of data location is already part of the data file and that the 
data plot can then be color coded according to data location. 

54. Regarding the motivation to combine Cook and Leftwich with Jamieson, 
Applicant contends that there is not motivation to combine the teachings of Cook and 
Leftwich with Jamieson. Applicant implies that the motivation is poorly defined and an 
opinion of the Examiner. However, the motivation is cited directly from the 
reference and therefore is inherently taught by the reference. Furthermore, the 
Applicant contends that there is an absence of evidence that Cook/Leftwich is deficient 
in easily providing additional information or navigating to more detailed information. 
Cook/Leftwich do not mention easily providing additional information or 
navigating to more detailed information, which is why the reference of Jamieson 
is combined with Cook/Leftwich. 

VIII. RELEVANT ART CITED BY THE EXAMINER 

55. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: 

The following references teach methods for acquiring and monitoring 
network traffic data: 
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Baker et al. (US Patent No. 6,266,700) 
Sufleta (US Patent No. 6,785,237) 
Cafarelli et al. (US Patent No. 6,760,845) 

The following references teach methods of displaying data collections using a 
graphical user interface and possessing zoom functionality: 
Baker et al. (US Patent No. 5,953,006) 
Wichelman (US Patent No. 6,785,540) 



IX. CLOSING COMMENTS 

Conclusion 

a. STATUS OF CLAIMS IN THE APPLICATION 

56. The following is a summary of the treatment and status of all claims in the 
application as recommended by M.P.E.P. ' 707.07(i): 

a(4). CLAIMS REJECTED IN THE APPLICATION 

57. Per the instant office action, claims 1-29 have received a first action on the merits 
and are subject of a first action non-final. 

b. DIRECTION OF FUTURE CORRESPONDENCES 
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58. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael B. McFadden whose telephone number is 
(571)272-8013. The examiner can normally be reached on Monday-Friday 8:30 - 5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Manorama Padmanabhan can be reached on (571)272-4210. The fax 
phone number for the organization where this application or proceeding is assigned is 
571-273-8300. 
IMPORTANT NOTE 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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09/11/2006 
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